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What is claimed is: 

1. A memory device storing a data structure for tracking 
network behavior, comprising: 

a connection table that maps each node of a network to a 
record object that stores information about traffic to or from 
the node and between that node and others nodes in the network. 



2. The device of claim 1 wherein the connection table 
includes a plurality of records that are indexed by source 
10 address. 



3. The device of claim 1 
includes a plurality of records 
address . 

4 . The device of claim 1 
includes a plurality of records 



wherein the connection table 
that are indexed by destination 

wherein the connection table 
that are indexed by time. 



5. The device of claim 1 wherein the connection table 
20 includes a plurality of records that are indexed by source 
address, destination address and time. 



6. The device of claim 1 wherein the connection table is 
a plurality of connection sub-tables each sub-table having data 

25 pertaining to network traffic over different time scales. 

7. The device of claim 1 wherein the connection sub- 
tables include a time-slice connection table that operates on a 
small unit of time and at least one other sub-table that 

30 operates on a larger unit of time than the time slice sub-table. 
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8. The device of claim 7 wherein the at one sub-table 
holds records received from all collectors over the time scale 
of the table. 

9. The device of claim 5 wherein the addresses indexing 
the connection table are IP addresses. 

10. The device of claim 1 wherein the addresses indexing 
the connection table are include a physical later address to . IP 
address map that is used to determine Host ID. 

11. The device of claim 1 wherein the host record of a 
first host also maps to a second host which communicates with 
the first host to a "host pair record" that has information 
about all the traffic from between the first and second hosts. 

12. The device of claim 1 wherein connection data 
structure enables a consuming device to obtain summary 
information about one host and about the traffic between any 
pair of hosts, in either direction. 

13. The device of claim 1 wherein a record stores a 
measure of the number of bytes, packets, and connections that 
occurred between hosts during a given time-period. 

14. The device of claim 1 wherein data in the record is 
organized by well known transport protocols and well-known 
application-level protocols. 

15. The device of claim 1 wherein host records have no 
specific memory limit. 
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16. The device of claim 1 wherein for application-level 
protocols and for every pair of hosts, the connection table 
stores statistics for traffic between the hosts. 

17. The device of claim 16 wherein the connection table 
stores protocol-specific records as (protocol, count) key-value 
pairs . 
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